An out of bounds read vulnerability in the flatcc schema lexer poses a high risk of denial of service through application crashes.

This is an out of bounds read vulnerability occurring within the schema lexer, specifically in the lex() function. An unauthenticated attacker can supply a malformed FlatBuffers schema with an unterminated quotation mark to trigger a heap buffer over read.

The vulnerability carries a CVSS score of 7.5, classifying it as a high severity risk. Successful exploitation results in an application crash, which can lead to significant service interruption for systems relying on flatcc for schema parsing. This denial of service capability may be leveraged to degrade the availability of critical infrastructure components.

Immediate Action: Developers should integrate the upstream fix identified in commit 8581715e8ec4e5de8eea9fd6dad949e4dd7d0fa0 into their local builds until an official release version is available.

Proactive Monitoring: Security teams should monitor application logs for unexpected termination events or segmentation faults that may indicate an exploitation attempt.

Compensating Controls: Implement input validation routines to sanitize schema files before they are processed by the lexer, ensuring that all strings are properly terminated.

Public Exploit Available: Unknown

Given the high severity and the availability of a proof of concept, organizations utilizing the flatcc library must prioritize the application of the upstream fix. Teams should verify their dependency trees to determine if they are pulling in the affected lexer logic and apply the necessary code patches immediately to maintain system availability.